Auth0 API | Logs › Search Log Events

Logs

logs

Methods

Search Log Events -> LogsPageNumberPage<{ audience, client_id, client_name, 17 more... }>

get/logs

Retrieve log entries that match the specified search criteria (or all log entries if no criteria specified).

Set custom search criteria using the q parameter, or search from a specific log ID ("search from checkpoint").

For more information on all possible event types, their respective acronyms, and descriptions, see Log Event Type Codes.

To set custom search criteria, use the following parameters:

q: Search Criteria using Query String Syntax
page: Page index of the results to return. First page is 0.
per_page: Number of results per page.
sort: Field to use for sorting appended with `:1` for ascending and `:-1` for descending. e.g. `date:-1`
fields: Comma-separated list of fields to include or exclude (depending on include_fields) from the result, empty to retrieve all fields.
include_fields: Whether specified fields are to be included (true) or excluded (false).
include_totals: Return results inside an object that contains the total result count (true) or as a direct array of results (false, default). Deprecated: this field is deprecated and should be removed from use. See Search Engine V3 Breaking Changes

For more information on the list of fields that can be used in fields and sort, see Searchable Fields.

Auth0 limits the number of logs you can return by search criteria to 100 logs per request. Furthermore, you may paginate only through 1,000 search results. If you exceed this threshold, please redefine your search or use the get logs by checkpoint method.

To search from a checkpoint log ID, use the following parameters:

from: Log Event ID from which to start retrieving logs. You can limit the number of logs returned using the take parameter. If you use from at the same time as q, from takes precedence and q is ignored.
take: Number of entries to retrieve when using the from parameter.

Important: When fetching logs from a checkpoint log ID, any parameter other than from and take will be ignored, and date ordering is not guaranteed.

Security

Example: Authorization: Bearer My Bearer Token

Parameters

fields: string

Optional

Comma-separated list of fields to include or exclude (based on value provided for include_fields) in the result. Leave empty to retrieve all fields.

from: string

Optional

Log Event Id from which to start selection from.

include_fields: boolean

Optional

Whether specified fields are to be included (true) or excluded (false)

include_totals: boolean

Optional

Return results as an array when false (default). Return results inside an object that also contains a total result count when true.

page: number

Optional

(minimum: 0)

Page index of the results to return. First page is 0.

per_page: number

Optional

(maximum: 100, minimum: 0)

Number of results per page. Paging is disabled if parameter not sent. Default: 50. Max value: 100

q: string

Optional

Query in Lucene query string syntax.

sort: string

Optional

Field to use for sorting appended with :1 for ascending and :-1 for descending. e.g. date:-1

take: number

Optional

Number of entries to retrieve when using the from parameter. Default 50, max 100

Response fields

UnionMember0 = Array<{ audience, client_id, client_name, 17 more... }>

UnionMember1 = { length, limit, logs, 2 more... }

Request example

curl https://login0.local.dev.auth0.com/api/v2/logs \
    -H "Authorization: Bearer $BEARER_TOKEN"

200Example

[
  {
    "audience": "audience",
    "client_id": "client_id",
    "client_name": "client_name",
    "connection": "connection",
    "connection_id": "connection_id",
    "date": "string",
    "description": "description",
    "details": {
      "foo": "bar"
    },
    "hostname": "hostname",
    "ip": "ip",
    "isMobile": true,
    "location_info": {
      "city_name": "city_name",
      "continent_code": "continent_code",
      "country_code": "xx",
      "country_code3": "xxx",
      "country_name": "country_name",
      "latitude": "latitude",
      "longitude": "longitude",
      "time_zone": "time_zone"
    },
    "log_id": "log_id",
    "scope": "scope",
    "strategy": "strategy",
    "strategy_type": "strategy_type",
    "type": "type",
    "user_agent": "user_agent",
    "user_id": "user_id",
    "user_name": "user_name"
  }
]

Get A Log Event By ID -> { audience, client_id, client_name, 17 more... }

get/logs/{id}

Retrieve an individual log event.